Key points
- Smart cities link traffic, alerts, utilities and city IT, so one compromise can affect several public services at once.
- In 2017 all 156 Dallas emergency sirens were set off for about 90 minutes; in 2018 SamSam ransomware disrupted Atlanta’s city services.
- In 2023, CISA, the NSA, the FBI and four allied agencies issued joint guidance on securing smart cities.
What this article covers: the security risks created when city services such as traffic control, emergency alerts and utilities are connected, illustrated by the Dallas and Atlanta incidents.
Its place in the series: the series’ city-scale view, showing how risks described in the grid, water and transport articles combine in one place.
A smart city connects public services to networks and sensors: traffic signals, street lighting, emergency alerts, water and energy monitoring, CCTV and the IT systems that run city departments. The benefit is efficiency. The risk is that a single compromise can affect many services at once, and that city systems are often older, under-funded and run by small teams.
Why smart cities concentrate risk
- Interconnection. Systems that were once separate now share networks, so a breach in one can reach others.
- Long-lived equipment. Traffic controllers, sirens and sensors are installed for many years and are often hard to update.
- Suppliers. Cities depend on many vendors, each with its own access and security practices.
- Public safety functions. Emergency alerts, traffic control and 911 dispatch are services where failure or false activation affects safety directly.
Dallas, 2017: emergency sirens set off at night
On the night of 7 to 8 April 2017, all 156 of Dallas’s outdoor emergency sirens were set off, repeatedly, for about 90 minutes before officials shut the system down (Bitdefender) (UPI). Nobody was hurt, but the city’s emergency call system was flooded with calls from frightened residents. The incident shows two dangers: false alarms that overload emergency services, and the erosion of public trust in warnings that people need to believe during a real emergency.
Atlanta, 2018: ransomware across a city government
In March 2018, the SamSam ransomware disrupted many of the City of Atlanta’s online systems, affecting services such as bill payment and court processes (Wikipedia summary). In November 2018, US prosecutors indicted two Iranian men over the SamSam campaign, which had also hit other cities and hospitals (NPR). Atlanta’s emergency services continued to operate, but the attack showed how a single ransomware incident can stall the everyday functions of a large city for weeks.
Where the risk to life comes from
- Traffic signals and transport control: manipulation could cause collisions or block emergency vehicles. See cyberattacks on transportation systems.
- Emergency alerting and dispatch: false alarms or outages during a real emergency.
- Water and energy: city-run utilities share the risks described in water supply attacks and power grid attacks.
What governments recommend
In April 2023, CISA, the NSA and the FBI, together with cyber agencies from the UK, Australia, Canada and New Zealand, published joint guidance on smart city security (CISA). Its main recommendations are (Cybersecurity Best Practices for Smart Cities):
- Plan security in from the start, including secure network design and segmentation.
- Manage supply-chain risk and require vendors to meet security standards.
- Prepare operational resilience, including manual fall-back procedures if connected systems fail.
- Protect the personal data that smart city sensors collect.
For the defensive approach across critical infrastructure in general, see Protecting Against Cyber Attacks on Critical Infrastructure. The series overview explains how failures in one system cascade into others.
Frequently asked questions
What are the main cybersecurity risks in smart cities?
Interconnected systems, long-lived equipment that is hard to update, dependence on many suppliers, and public safety functions such as traffic control and emergency alerts, where a compromise affects people directly.
What happened when Dallas’s emergency sirens were hacked?
On the night of 7 to 8 April 2017, all 156 of Dallas’s outdoor emergency sirens were set off repeatedly for about 90 minutes. No one was hurt, but the emergency call system was flooded with calls.
What was the Atlanta ransomware attack?
In March 2018 the SamSam ransomware disrupted many City of Atlanta online services. In November 2018, US prosecutors indicted two Iranian men over the SamSam campaign.
How can cities protect smart infrastructure?
Joint guidance published in 2023 by CISA, the NSA, the FBI and partner agencies recommends secure design and network segmentation, supply-chain risk management, manual fall-back procedures and protection of personal data.
Last reviewed: 21 October 2026. This article is research and analysis based on publicly documented incidents, government advisories and published security research, linked inline.
